SOC Manager

{
  "content_hash": "aa5a843160b73a95ab715caead082539f77f016bd0e46fc92a17395f176a0f9c",
  "source_hash": "eb35dc3bac90f6a65d6b3c1533bdf0ba8590af85a28859382fc43ab0b8a6c863",
  "last_changed_at": "2026-05-29T07:00:32.584Z",
  "active_status": "active"
}

{
  "language": "en",
  "location": {
    "raw": "Miami",
    "city": "Miami",
    "region": "FL",
    "country": "United States",
    "is_remote": false,
    "confidence": 0.75
  },
  "salary_max": null,
  "salary_min": null,
  "inferred_at": "2026-06-06T19:42:37.077Z",
  "launch_scope": {
    "reason": "english_us_canada",
    "included": true,
    "language": "en",
    "location": {
      "raw": "Miami",
      "city": "Miami",
      "region": "FL",
      "country": "United States",
      "is_remote": false,
      "confidence": 0.75
    },
    "countries": [
      "United States"
    ]
  },
  "remote_policy": null,
  "salary_period": null,
  "workplace_type": "on_site",
  "salary_currency": null
}

{}

{
  "lists": [
    {
      "text": "Day To Day:",
      "content": "<div>\n<h4><strong>SOC Governance &amp; Operating Model</strong></h4>\n\n<li>\n<p>Define and operationalize the SOC mission, scope, and service boundaries</p>\n</li>\n<li>\n<p>Establish a clear roles, responsibilities, and escalation hierarchy</p>\n</li>\n<li>\n<p>Build and maintain a RACI model across internal teams and Managed SOC Provider</p>\n</li>\n<li>\n<p>Own the effectiveness and maturity of Iru’s hybrid SOC model</p>\n</li>\n\n<h4><strong>Operational Ownership &amp; Execution</strong></h4>\n\n<li>\n<p>Clearly define and enforce ownership across:</p>\n\n</li><li>\n<p>Detection engineering</p>\n</li>\n<li>\n<p>Threat intelligence</p>\n</li>\n<li>\n<p>Tier 1 alert triage</p>\n</li>\n<li>\n<p>24/7 monitoring</p>\n</li>\n<li>\n<p>Incident response leadership</p>\n</li>\n<li>\n<p>Threat hunting</p>\n</li>\n<li>\n<p>Escalation investigations</p>\n</li>\n\n\n<li>\n<p>Establish and manage the “first call” model for security incidents at Iru</p>\n</li>\n<li>\n<p>Serve as incident commander for high-severity events or delegate appropriately</p>\n</li>\n\n<h4><strong>MDR (Managed SOC Provider) Management</strong></h4>\n\n<li>\n<p>Own the operational relationship with Managed SOC Provider</p>\n</li>\n<li>\n<p>Ensure alignment on:</p>\n\n</li><li>\n<p>Alert triage quality and consistency</p>\n</li>\n<li>\n<p>Escalation thresholds and timelines</p>\n</li>\n<li>\n<p>Detection coverage across environments</p>\n</li>\n<li>\n<p>Incident response coordination</p>\n</li>\n\n\n<li>\n<p>Hold Managed SOC Provider accountable to defined SLAs and performance expectations</p>\n</li>\n<li>\n<p>Continuously improve MDR effectiveness through feedback loops and tuning</p>\n</li>\n\n<h4><strong>Detection Engineering</strong></h4>\n\n<li>\n<p>Build and maintain a central detection catalog</p>\n</li>\n<li>\n<p>Align detections to MITRE ATT&amp;CK where applicable</p>\n</li>\n<li>\n<p>Partner with internal teams and Managed SOC Provider to:</p>\n\n</li><li>\n<p>Develop new detections</p>\n</li>\n<li>\n<p>Tune and optimize existing rules</p>\n</li>\n<li>\n<p>Reduce false positives and noise</p>\n</li>\n\n\n<li>\n<p>Ensure detection coverage across:</p>\n\n</li><li>\n<p>Identity (Iru Identity, Entra)</p>\n</li>\n<li>\n<p>Endpoint (EM / EDR)</p>\n</li>\n<li>\n<p>Cloud (AWS)</p>\n</li>\n<li>\n<p>SaaS and integrations</p>\n</li>\n\n\n\n<h4><strong>Data &amp; Telemetry Strategy</strong></h4>\n\n<li>\n<p>Maintain a complete inventory of all telemetry sources across:</p>\n\n</li><li>\n<p>Endpoint, Identity, Cloud, Network, SaaS</p>\n</li>\n\n\n<li>\n<p>For each data source:</p>\n\n</li><li>\n<p>Define system owner</p>\n</li>\n<li>\n<p>Confirm ingestion into Panther SIEM</p>\n</li>\n<li>\n<p>Validate data quality and coverage</p>\n</li>\n\n\n<li>\n<p>Drive onboarding of new log sources to close visibility gaps</p>\n</li>\n\n<h4><strong>Incident Response Framework</strong></h4>\n\n<li>\n<p>Design and maintain Iru’s incident response framework, including:</p>\n\n</li><li>\n<p>Incident classification and severity model</p>\n</li>\n<li>\n<p>Evidence collection standards</p>\n</li>\n<li>\n<p>Containment and remediation procedures</p>\n</li>\n<li>\n<p>Recovery processes</p>\n</li>\n<li>\n<p>Post-incident review and lessons learned</p>\n</li>\n\n\n<li>\n<p>Ensure consistent execution across internal teams and Managed SOC Provider</p>\n</li>\n\n<h4><strong>Runbooks &amp; Playbooks</strong></h4>\n\n<li>\n<p>Develop and maintain:</p>\n\n</li><li>\n<p>Alert triage procedures</p>\n</li>\n<li>\n<p>Investigation runbooks</p>\n</li>\n<li>\n<p>Incident response playbooks</p>\n</li>\n\n\n<li>\n<p>Ensure all runbooks are actionable, tested, and continuously improved</p>\n</li>\n\n<h4><strong>Threat Intelligence &amp; Hunting</strong></h4>\n\n<li>\n<p>Integrate threat intelligence into detection and response workflows</p>\n</li>\n<li>\n<p>Define ownership model for threat intelligence (internal vs MDR)</p>\n</li>\n<li>\n<p>Establish proactive threat hunting capabilities</p>\n</li>\n<li>\n<p>Evaluate and integrate external threat hunting services as needed</p>\n</li>\n\n<h4><strong>SOC Metrics &amp; Reporting</strong></h4>\n\n<li>\n<p>Define and track key SOC KPIs:</p>\n\n</li><li>\n<p>Mean Time to Detect (MTTD)</p>\n</li>\n<li>\n<p>Mean Time to Respond (MTTR)</p>\n</li>\n<li>\n<p>Alert volume and trends</p>\n</li>\n<li>\n<p>False positive rates</p>\n</li>\n<li>\n<p>Detection coverage and gaps</p>\n</li>\n\n\n<li>\n<p>Provide regular reporting to Security Leadership and executive stakeholders</p>\n</li>\n<li>\n<p>Use metrics to drive SOC maturity and continuous improvement</p>\n</li>\n\n</div>"
    },
    {
      "text": "Nice to haves, but NOT required:",
      "content": "<div>\n\n<li>\n<p>Prior experience helping mature or build a security operations program from the ground up.</p>\n</li>\n<li>\n<p>Background in threat hunting or detection engineering.</p>\n</li>\n<li>\n<p>Experience integrating Wiz or similar cloud posture management tools into a SIEM workflow.</p>\n</li>\n<li>\n<p>Knowledge of security automation frameworks, including alert enrichment and workflow orchestration.</p>\n</li>\n<li>\n<p>Hands-on experience supporting hybrid (Mac + Windows) endpoint environments.</p>\n</li>\n\n</div>"
    }
  ],
  "country": "US",
  "createdAt": 1777058881136,
  "updatedAt": null,
  "categories": {
    "team": "Security and Trust",
    "location": "Miami",
    "department": "G&A",
    "allLocations": [
      "Miami"
    ]
  },
  "salaryRange": null,
  "workplaceType": "onsite"
}